A SIEM correlation rule fires for a Microsoft 365 executive mailbox. At 02:14, the account signs in from a new country. At 02:17, the mailbox gets a forwarding rule that sends all mail to an external address. The user says they did not travel and did not create any rules. Which two log sources should the analyst review first to confirm whether this is account takeover or token abuse? Select two.

DHCP lease logs, because they identify the internal workstation that first received the suspicious email.

DHCP logs can help map a device to an IP address, but they do not explain a cloud mailbox forwarding rule or a foreign sign-in. They are too indirect for confirming account takeover or token abuse in this scenario.

Print server logs, because mailbox forwarding often causes documents to be printed unexpectedly.

Print logs are unrelated to sign-in origin and mailbox rule creation. They would not provide evidence about how the account was accessed or whether an attacker used a valid session token.

Physical badge-access logs, because they prove whether the user was in the office when the login occurred.

Badge logs may support an alibi check, but they do not prove malicious access or identify the session source. They are useful only as supporting context, not as the first source for this mailbox compromise investigation.

What does this SY0-701 question test?

Read the scenario before looking for a memorised answer.

What is the correct answer to this question?

The correct answer is: Identity provider sign-in logs, because they show source IP, MFA status, and session creation details. — The analyst should start with identity provider sign-in logs and mailbox audit logs. The sign-in logs show whether the account authenticated from an unusual location, whether MFA was satisfied, and whether a suspicious session was created. The mailbox audit logs show whether the attacker used that access to create forwarding rules or other persistence mechanisms. Together, these sources link identity compromise to the exact mailbox changes that triggered the alert. Why others are wrong: DHCP, print, and badge logs can provide context, but they do not directly prove account takeover or show mailbox rule changes. DHCP only maps internal addresses, print logs do not relate to authentication, and badge logs only indicate physical presence. They are too far removed from the observed cloud-mail events to be the first places to investigate.

What should I do if I get this SY0-701 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.